\section{Background}
\label{sec:Background}

\subsection{Usage Control \& Obligations }
\subsection{XACML 3.0}
Describe XACML model and Highlight new features related to XACML 3.0:
\begin{itemize}
 \item Definition of new Combining Algorithm is possible
 \item Indeterminate given as response for only one applicable when many target match the request. Non applicable is given when no target matches the request
 \item There is an administrative policy profile in XACML 3.0
 \item Interest of using advice expressions as optional obligations to specify desirable actions that should be taken in certain circumstances.
 \item Interest of using hierarchical rules (x)
 \item Administrative and delegation policies, delegation depth, multiple decision profile, new combining algorithms (deny unless permit, permit unless deny).
 \item Dynamic assignment of parameters introduced in XACML 3.0 allows high flexibility (x)
\end{itemize}
Obligations in XACML (both v2 and v3) are considered as attributes assignment. 
In XACML 3.0 obligations are introduced into the rules and dynamic expressions have been introduced into the obligations statements:
The following example describes an obligation in XACML 2.0: On deny, tell the PEP to send an email to the administrator:
\tiny{
\begin{lstlisting}
  <xacml2:Obligations>
    <xacml2:Obligation FulfillOn="Permit" ObligationId="email">
      <xacml2:AttributeAssignment AttributeId="email" 
      DataType="http://www.w3.org/2001/XMLSchema#string">
      administrator@acme-xacml.org</xacml2:AttributeAssignment>
    </xacml2:Obligation>
  </xacml2:Obligations>	
\end{lstlisting}}
\normalsize{In XACML 3.0, it becomes possible to mention that on deny, tell the PEP to send an email to the requester's line manager:}

\tiny{
\begin{lstlisting}
    <xacml3:ObligationExpressions>
    <xacml3:ObligationExpression FulfillOn="Permit" 
    ObligationId="email">
      <xacml3:AttributeAssignmentExpression AttributeId="emailId" 
        Category="urn:oasis:names:tc:xacml:
        1.0:subject-category:access-subject" Issuer="">
        <xacml3:AttributeDesignator AttributeId="manager-email" 
        Category="urn:oasis:names:tc:xacml:
        1.0:subject-category:access-subject" 
        DataType="http://www.w3.org/2001/XMLSchema#string" 
        MustBePresent="false"/>
      </xacml3:AttributeAssignmentExpression>
    </xacml3:ObligationExpression>
  </xacml3:ObligationExpressions>
\end{lstlisting}}

\normalsize
\subsection{XACML Workflow Architecture}
XACML data flow architecture is described in Figure \ref{proposeddataflow}:
%\begin{figure}[!h]
%\begin{center}   
%\includegraphics[scale=0.38]{dataflow}
%\caption{XACML Dataflow Diagram}
%\label{dataflow}
%\end{center}
%\end{figure}

\begin{itemize}
 \item 1) PAPs write policies and policy sets and make them available to the PDP. 
 These policies or policy sets represent the complete policy for a specified target
 \item 2) The access requester sends a request for access to the PEP
 \item 3) The PEP sends the request for access to the context handler in its native request format, optionally including attributes  of the subjects, 
 resource, action and environment
 \item 8) The context handler constructs an XACML request context and sends it to the PDP
 \item 9) The PDP requests any additional subject, resource, action, and environment attributes from the context handler
 \item 4) The context handler requests the attributes from a PIP
 \item 5) The PIP obtains the requested attributes
 \item 6) The PIP returns the requested attributes to the context handler
 \item 7) Optionally, the context handler includes the resource in the context
 \item 8,9) The context handler sends the requested attributes and (optionally) the resource to the PDP. The PDP evaluates the policy
 \item 10) The context handler translates the response context to the native response format of the PEP. The context handler returns the response to the PEP
 \item 11) The PEP fulfills the obligations
 \item (Not shown) If access is permitted, then the PEP permits access to the resource, otherwise, it denies access
\end{itemize}
